Add Playwright e2e tests; fix two real bugs they caught

fix: OIDC_ISSUER_URL used Authentik's LAN IP (192.168.1.208:9443).
Authentik's discovery doc echoes back whichever host you query it
through, so that LAN IP got baked into authorization_endpoint -- the
URL the *browser* gets redirected to. Anyone off the LAN got sent to
an address they couldn't reach. Authentik was already publicly
exposed at auth.jerodrigged.com (pre-existing NPM proxy host); switched
to that, which also has a real cert so OIDC_ALLOW_INSECURE_TLS could
go back to false. Reported as "signed in via Authentik, redirected to
the local IP, failed."

fix: frontend's request() helper always sent Content-Type:
application/json, even for logout's bodyless POST. Fastify's default
JSON parser rejects an empty body under that content-type (400) --
sign-out silently failed to log the user out. curl-based testing
missed this because curl doesn't set that header without -d. Caught
immediately by the new Playwright local-login test.

e2e/: Playwright suite for local auth and OIDC login. OIDC test uses
a dedicated Authentik test user (blueprint-provisioned, never a real
personal login) so the whole flow can run unattended and repeatedly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -17,14 +17,20 @@ ADMIN_PASSWORD=
 # additionally show a "Sign in with Authentik" button — see docs/oidc-setup.md
 # for how the Authentik provider was set up.
 OIDC_ENABLED=false
-OIDC_ISSUER_URL=https://192.168.1.208:9443/application/o/homelab-monitor/
+# MUST be the public hostname, not the LAN IP (192.168.1.208:9443) -- Authentik's
+# discovery doc echoes back whichever host you query it through, and that value
+# gets baked into authorization_endpoint, which the *browser* is redirected to.
+# Using the LAN IP here sends anyone off-LAN to an address they can't reach.
+# See docs/oidc-setup.md for the bug this caused.
+OIDC_ISSUER_URL=https://auth.jerodrigged.com/application/o/homelab-monitor/
 OIDC_CLIENT_ID=
 OIDC_CLIENT_SECRET=
 # Public URL is primary since issue #13 shipped; the LAN URL is also registered
 # in Authentik as a fallback (see docs/oidc-setup.md) if you need to switch back.
 OIDC_REDIRECT_URI=https://monitor.jerodrigged.com/api/auth/oidc/callback
-# Authentik's cert is self-signed on the LAN, same situation as Proxmox's API.
-OIDC_ALLOW_INSECURE_TLS=true
+# auth.jerodrigged.com has a real Let's Encrypt cert (unlike the LAN IP's
+# self-signed one), so this can stay false when OIDC_ISSUER_URL is the public URL.
+OIDC_ALLOW_INSECURE_TLS=false
 
 # Set to true only once a TLS-terminating reverse proxy sits in front (see
 # issue #13). Leave false for plain-HTTP LAN access, otherwise the session